Enryption in WPF

Avuya Mxoli

14y5.7k

Hi all,

I am working on a login form where I would like the user passwords to be encrypted, I don't have a clue how this works can someone please help. I am using c# to do this. I am not looking for something too tight though, I will be working with a 64-bit key for the password.

Thanks in advance

9 Replies

Know the answer? Post it — somebody with the same question will find it here.

Vulpes14y ago
Accepted answer
Here's a console app I've written to show how you could use MD5 to hash and then verify a password:

using System;
using System.Security.Cryptography;
using System.Text;

class Test
{
static void Main()
{
string password = "vulpes123";
byte[] hash = MD5.Create().ComputeHash(Encoding.UTF8.GetBytes(password));

// now check various passwords for correctness
string[] passwords = {"avuya456", "vulpes789", "vulpes123"};
foreach(string pwd in passwords)
{
if (VerifyPassword(hash, pwd))
{
Console.WriteLine("The correct password is {0}", pwd);
Console.ReadKey();
return;
}
}
}

static bool VerifyPassword(byte[] hash, string password)
{
byte[] pwdHash = MD5.Create().ComputeHash(Encoding.UTF8.GetBytes(password));
for(int i = 0; i < 16; i++)
{
if (pwdHash[i] != hash[i]) return false;
}
return true;
}
}
Vulpes14y ago
Well, the database should contain the hash itself rather than the password.

So, you need to hash the password entered in the textbox and then compare the result with the hash in the database for the user in question.

The code will be on these lines:

if (textBox1.Text.Length > 0)
{
byte[] hash = SHA256.Create().ComputeHash(Encoding.UTF8.GetBytes(textBox1.Text));

// check it against hash in database
}
Avuya Mxoli14y ago
Hi Vulpes, I tried it and writing to the database the hash works perfectly now I cant seem to figutre out how to read the hash and check if its correct. I use MVVM so this is really not straight forward but let me try walk you through. I have a login screen which takes the staffNr, username and password. I then check the staffNr against ones that are already in the login table in my database via a stored procedure. Then I take the password entered in the text box and from there I dont know how to apply the hash algorithm. In the console app you gave me can you tell me what I should substitute with to make it work. I know I have to get the password from the database,hash it and check it against the hash of the entered password but I just cant get my head around it. I hope you can help me with this.
Vulpes14y ago
That's right, Avuya.

Incidentally, if you're happy with using a hash algorithm, I'd use SHA256 rather than MD5 which is much more secure as it uses a 256 bit rather than a 128 bit hash and is still reasonably quick.

Just replace MD5 with SHA256 in the two places it occurs in the above program.

You can also increase the security of hashing algorithms by hashing multiple times rather than just once which makes 'dictionary' attacks much more time-consuming. However, this may be out of place here if you're only looking for moderate security.
Avuya Mxoli14y ago
Oh I see, Thank you very much I will implement this and let you know if I come across any hiccups. So from what I understand I will let the user enter their username and password then when I write them to the database, I will only write the "hash"(referencing to your example now) then when they login again I will use the "verify password" method to check if its correct...
Vulpes14y ago
No, hash algorithms only provide one-way encryption.

For passwords, this is usually all you need. You simply hash the password and store the hash in the database (you don't store the password as well).

If someone then enters their password to log in, you then compute the hash of the password entered and check it against the hash in the database. If they're the same, then the login can proceed.

Cryptographic hash algorithms are always such that the chance of a collision (i.e. two passwords having the same hash) are either zero or extremely slim.
Avuya Mxoli14y ago
Thanks, does your example also decrypt the password? Because for this app I'm doing I'm gonna need to be able to decrypt it as well. Basically, I want my users to login and I will store their login details in a file. Now I want to be able to read the encrypted password for verification when they login again.
Avuya Mxoli14y ago
Thanks Vulpes for the links but I'm not quite sure how to apply this
Vulpes14y ago
Normally passwords are encrypted using cryptographic hashing algorthms which provide 'one way' encryption.

However, the weakest (and fastest) of these supported by the .NET Framework is MD5 which has a hash length of 128 bits:

http://msdn.microsoft.com/en-us/library/system.security.cryptography.md5.aspx

If you're looking for something that has a hash length of only 64 bits, then you may have to write it yourself.

The DES symmetric algorithm has a 64 bit key length but I'd have thought it would be rather tedious to use for passwords:

http://msdn.microsoft.com/en-us/library/system.security.cryptography.des.aspx